Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

An anonymous reader writes "Microsoft has removed HTTPS from Hotmail for many US-embargoed or otherwise troubled countries. The current list of countries for which they no longer enable HTTPS is known to include Bahrain, Morocco, Algeria, Syria, Sudan, Iran, Lebanon, Jordan, Congo, Myanmar, Nigeria, Kazakhstan, Uzbekistan, Turkmenistan, Tajikistan, and Kyrgyzstan. Journalists and others whose lives may be in danger due oppressive net monitoring in those countries may wish to use HTTPS everywhere and are also encouraged to migrate to non-Microsoft email providers, like Yahoo and Google."Update: 03/26 17:08 GMT by T: Reader Steve Gula adds the caveat that "Yahoo! only does HTTPS for authentication unless you're a paying member."

I don't know what Microsoft are thinking here but seeing as it's using the country you set in your profile; not any sort of geoip lookup... the remedy is simple: just change the country in your profile.

Now explain to my grandmother, who just got her first email last week, how and why she needs to do that.

On the other hand, the oppressive governments over there will LOVE that. It's probably even better than insecure FB or Twitter since everything ultimately goes to the people's emails.
As someone from one the mentioned countries, I'd like to ask Microsoft, do you realize now you might be very well putting many people at a greater risk of being arrested or killed. People are being KILLED for expressing some of their opinions in some of these places these days.

Dude its a fricking bug. It isn't even a fricking bug that blocks HTTPS, it just doesn't set it as default. Big fricking whoop, you just have to go in and set it. And anybody who is in a repressive country and sending shit that may get them in trouble to their email account without even using Tor or some other obfuscation is seriously asking for it anyway.

Now if they had issued a press release that said "Countries A-K will NOT have HHTPS access" that would be one thing, and they'd deserve to get nailed for

Dude its a fricking bug. It isn't even a fricking bug that blocks HTTPS, it just doesn't set it as default. Big fricking whoop, you just have to go in and set it. And anybody who is in a repressive country and sending shit that may get them in trouble to their email account without even using Tor or some other obfuscation is seriously asking for it anyway.

Their "bug" (if that is really what it is) has just exposed a lot of people to arrest, abuse, and murder. Just because you're laying your life on the line

The only way anyone would've hit this bug is if they were trying to make their account default to HTTPS while the bug was active. If you'd already set to HTTPS by default, that would still have worked. So, if it exposed anyone to arrest, it would be because they continued past the bug to do risky things anyway.

Now explain to my grandmother, who just got her first email last week, how and why she needs to do that.

If your grandmother only received her first email last week then she definitely, absolutely, imperatively must stay away from 'that'. I'm amazed this has been moderated insightful. We've gone from 'think of the children' to 'think of the grandmothers' as a shortcut for those two lazy to engage in thoughtful analysis.

Maybe not their grandmother. But plenty of grandmothers are getting shot in the streets this week in some of those countries. Next week it'll be some other of those countries, and the week after that...

And yes, some people who are emailing other people about their revolutionary plans and actions are somebody's grandmother. And most of these people have better things to do than stay on top of how MS is revoking the HTTPS they'd already heard for years would keep their emails secret.

And yes, some people who are emailing other people about their revolutionary plans and actions are somebody's grandmother.

Well are they now? When and if grandmothers are getting shot on the streets, DO NOT encourage them to mess around with technology they don't understand, ESP those "who just got her first email last week" (see GP). I'm not taking about messing with the settings - I'm saying just DON'T do it.

I believe the point he's trying to make is that anonymity/security on the internet, especially in a hostile country, is a very hard thing to accomplish and is best left to people who now what they are doing. By all means grandma can send and receive emails about recipes and photos of grandkids to her hearts content and nobody will break down her door for it HTTPS or not, but when grandma starts planning a revolution she better not be assuming that she'll be safe and secure on the internet and if she can't

By what metric? Total accounts? Accounts accessed in the last month? Volume of mail?
The first metric isn't much good, because a lot of those will be the leftovers of customers who long ago fled the service. Accounts accessed recently is better.

Fun fact:You're wrong. The largest is Yahoo! Mail [email-mark...eports.com] followed by Gmail with Hotmail third.

I personally think THIS is why Ballmer had such a hard on to buy out Yahoo! and why they were quick to jump on the search deal, as Yahoo Mail has a TON of users and funnily enough the Yahoo Web Portal is the #1 home page (Yeah I know its a cluttered mess, apparently people like cluttered messes) by a large margin. Hell that damned portal is so popular now the only time I notice anymore is when someone brings in a PC to be fixed and Yahoo Portal ISN'T the default, that is how damned popular that thing is.

As for TFA they ain't blocking HTTPS they had a bug that screwed up setting HTTPS as default. Surprise surprise new software rollout finds a bunch of bugs that need fixing. Until they chase down the bugs you can either use the FF plugin or just set it manually which isn't exactly a hardship. If this were anyone else it wouldn't even rate a mention but since it is MSFT the tinfoil hatters have to get in a few shots.

Hell only the old folks use Hotmail anymore anyway, mostly those like my dad that got a branded account with his DSL. I can't even remember the last time I saw a customer under 50 that had Hotmail bookmarked. Everyone else it is Yahoo Mail followed by Gmail for the under 30s.

With how ridiculous the government and some elements of corporate America have become in the US as of late, sharing obvious information like that is bound to get you branded as a "domestic terrorist..."

As noted below, China is not on the list. I think the summary is misleading. TFA says MS has turned off the 'always-use-HTTPS' option - not the 'HTTPS' option. Otherwise you couldn't get the HTTPS-Everywhere extension to work.
From TFA:

Hotmail users who browse the web with Firefox may force the use of HTTPS by default—while using any Hotmail location setting—by installing the HTTPS Everywhere Firefox plug-in.

China doesn't need to have encryption turned off. They just ask MS nicely to hand them the key and MS will comply if it makes them a buck. If you rely on big corporations for confidentiality in oppressive regimes the size of China, you're a fool.

Most hotmail users do not know what HTTPS is. This move effetively disables cryptography for 90% of the users.

well, 90% of people on Slashdot don't know what HTTPS is - 90% of the other 10% are probably displaying a rather cock-sure, blissful ignorance. Think about it: a message going from country A to country B, two wifi connections that may or may not be encrypted, two governments that may or may not be intruding, two providers that may be cooperating with the former to varying degrees. If you don't know what https, say away from it. Don't tell anybody they're getting 'cryptography' if you're not able to give the

Yes. But they are not too overzealous when it comes to dealing with tourists (who wants to start international scandal, when the poor bugger is of no threat). Should they be sure that you were using encryption to communicate with dissidents inside China, that would be a totally different story.

So something like the Google censorship issue: The company bosses don't *want* to comply with the laws of an oppressive country, but that's the only way to do business with a very lucrative market, and their first duty is to the shareholders.

Perhaps they are trying to use the Host HTTP header to perform multi-site hosting on their services which is impossible to do under https because of the SSL handshaking. This would save lots of IP addresses.... Oh wait, nevermind [slashdot.org]

If you're providing "publicly available source code" (as Firefox is, and Microsoft isn't), the export controls almost melt away. You have to send in a notification [doc.gov], but no review is required.

Microsoft, on the other hand, doesn't have it quite so easy, but I'm sure that their reviews get expedited, so I seriously doubt that EAR/ITAR plays any role in this.

Presumably the US could just ask MS nicely for a neat digest of accounts of interest, delivered from their US-located datacenters, rather than asking them nicely to turn off SSL, and then having to MITM a whole bunch of people in a variety of largely hostile locales...

SSL doesn't exactly keep Microsoft from reading your hotmail, it just keeps those between you and them from doing so(terms and restrictions may apply...)

Presumably the US could just ask MS nicely for a neat digest of accounts of interest, delivered from their US-located datacenters, rather than asking them nicely to turn off SSL, and then having to MITM a whole bunch of people in a variety of largely hostile locales...

They could but there is more hassle in this and it also shows who they're interested in. I actually suspect that GP is correct in that this is something MS is doing for the US govt. rather than for the local governments. Reason being that those local governments control the ISPs and telecoms services there and probably don't need something like this to spy, or would even find it that helpful. But foreign spies who aren't affiliated with the local government would find it useful when they're trying to eavesd

I'm glad you don't work for my bank. "There's a small chance your account might have been compromised, so we sent you this post card with all your private information on it so you know you aren't secure. Have a nice day!"

Yeah, the good old Microsoft solution to just about any problem: don't fix it, just throw up another useless dialog box.

And people wonder why users just click through any message without reading it. Every time I use Windows, I start to understand that attitude more and more; there is no more dialog-happy OS on the planet.

Although far less sensational than "MS are evil and oppressing poor victims of the world", it's still a bit of a PR nightmare for MS.

To be clear, MS have allowed a bug to creep into one of their biggest front-line communication services that caused people in countries like Syria, Bahrain and Iran to lose a key element of their email security, in the middle of one of the biggest popular uprisings / state crackdowns in decades.

If my oven set my house on fire, I'd be pissed. It would be only small comfort to k

The Microsoft executives who made this decision have worked very hard for their entire adult lives to achieve the position they are in. Many years of hard work in college and climbing the ranks at Microsoft have put them where they are today. So, then, why have they leveraged those years of hard work in the name of oppression?

They were out to get people, for.. however short a period of time it was broken

It got into the news and was embarassing for them from a PR standpoint, so they did a U-turn. Wouldn't be the first time. (See also, for example, Microsoft's significant assistance to the Russian government in shutting down the opposition there via police raids on opposition organisations for using "pirated" MS software. Complete with falsified statements from Microsoft's representatives that they were using pirate software even when they weren't. They were willing to let that continue right up until it got

And your post is another cynical data point in the bandwagon jumping paranoid delusional mindset of the "omg the bad corporations are out to get me!" crowd. This was identified as a bug and has been resolved. Where does all your blathering about morality end up, then? Yes - on the garbage heap.

So in the places where HTTPS is most needed to protect people's lives, Microsoft kowtows to pressure from a bunch of soon-to-be-ex Pol Pot dictators to trick people into using unencrypted traffic so that they can be snooped upon?

To everyone in the Middle East, when the revolution is through, remember who your friends were, and remember which large company tried to sell you out, then choose your purchases accordingly. Remember, developing nations have more influence on corporations through their buying powe

Yeah, and whenever some stupid asshole jumps to conclusions and blathers a bunch of paranoid delusional bullshit, have you ever noticed they refuse to accept any explanation other than the evil they initially attributed the incident to? Kind of the mindset of Troofers, Birfers, and anti-Evolutionists really. No matter what evidence you put forward, they will never accept anything other than the delusion that gives them their mental high.

I'm genuinely curious what the logic is. "zOMG the Feds!!!" seems unlikely(because Microsoft doesn't exactly have to crack the SSL connection between you and itself to watch you and provide whatever information they wish...) It also seems somewhat unlikely that they received a "disable SSL or we block you" ultimatum, in silence, from a veritable laundry list of undesirable locations at the same time. Those countries also represent a reasonably broad spectrum of different flavors of repressive fucked-upness, and a fair variety of different levels of "they may be dictators with blood on their hands; but they serve our interests", everything from "They are our good buddies who let us headquarter the 5th fleet" to "we would really prefer if they died in a fire.."

That makes it sort of tricky to assign a foreign-policy based incentive behind Microsoft's activities. Economics, though, isn't obviously more helpful. That list represents one hell of a GDP spread, from "barely subsisting" to "oil plutocracy", so it doesn't seem to be a straightforward 'eh, you guys just aren't worth the SSL costs, fuck it." cutoff.

Why is summary recommending Yahoo in this instance? Last time I checked (10 mins ago) I couldn't get Yahoo mail to use https on regular pages. It seems Hotmail can still use https in the affected countries - as long as you explicitly type it in the address bar. Or use HTTPS Everywhere. Or choose a different country in your profile. So Hotmail is still better than Yahoo?

Microsoft is blaming a mystery bug for preventing access to the encrypted version of Hotmail, denying that it deliberately blocked access to the service in Syria.

On Friday afternoon, the company told The Reg that Hotmail users who had already enabled the HTTPS version of the popular email service were still able to use it. Only Hotmailers trying to turn on HTTPS for the first time in certain countries and languages were being blocked, Microsoft said.

People trying to connect were greeted with the message: "Your Windows Live ID can't use HTTPS automatically because this feature is not available for your account type."

Microsoft said it still doesn't know what caused the bug, but it has been resolved and the company is investigating the cause. "We do not intentionally limit support by region or geography and this issue was not restricted to any specific region of the world. We apologize for any inconvenience to our customers that this may have caused," a Microsoft spokesperson said.

The company said users in the Bahamas, Cayman Islands, and Fiji were also affected.

Mod up indeed. People as cynical as The Register should do more than just report the MS press-release. Someone stated above that hotmail was still the No. 1 mail service. That list of countries just happen to have https choices suspended isn't organised in any programming order. If it was Swaziland, Sweden, Switzerland and Syria, then one would feel more inclined to believe them.

Actually, Morocco didn't ask M$ to suppress access to HTTPS. And in fact, Gmail over HTTPS works perfectly fine there. It looks like Microsoft are just guessing who might want to snoop, and offering that as a feature, without even being asked. Oh, anyone remember the Microsoft Surveillance Guide [geekosystem.com]?

I guess it shows Bill is not running things anymore.....I am not so sure he would have buckled under the pressure of what is going on over there politically to change HIS windows or hotmail to be easier for the feds to access.

A lot of people posting already assume that there's some financial consideration involved; but I can't see that realistically being the case. But the problem is - I can't come up with a logical explanation for this that fits any reasonable supposition.

It would help if Microsoft would say why - we'd have to analyze it and parse the double-speak, obviously, but we'd at least have some meager clue. As it is, it's simply just bizarre.

One possibility, and quite a good one, is that it helps the USA to spy. After all, a US spy can't just use the local authorities tools, but they can sniff the wireless traffic of the people in an apartment block.

Well it certainly doesn't appear to be a good thing, but let's at least clean up the usual more-incendiary-than-it-needs-to-be summary (TUMITINTBFS). A few months ago, MS added a setting to it's Live accounts, where you could set it to use HTTPS automatically.What appears to have happened is that this has been provided for some countries, e.g. the USA, but not for some Middle Eastern and Eastern European countries (including Iran). So this isn't some long-standing feautre that has suddenly been removed. Also, it seems that HTTPS is still available, but can't be set to be automatically enabled. So the feature is not prevented, merely not as convenient.

So not a good thing on MS's part, apparently, but at least lets have some decent information.